^ AJViENDMENTS TO THE DRAWINGS : 

The attached sheets of drawings include changes to Figs. 1-2 and Figs. 3a-3f. 
These sheets, which include Figs. 1-2 and Figs. 3a-3f, replace the original sheets including Figs. 
1-2 and Figs. 3a-3f. In Figs. 1-2, descriptive labels for boxes have been added. In Figs. 3b-3d, 
the label "Prior Art" has been added. 

Attachments: 3 Replacement Sheets 
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REMARKS 

This Preliminary Amendment cancels without prejudice claims 1 to 1 1 in the 
imderlying PCT Application No. PCT/DE03/02310, and adds without prejudice new claims 12 to 
26. The new claims, inter alia^ confomi the claims to United States Patent and Trademark Office 
rules and do not add new matter to the application. 

In accordance with 37 C.F.R. § 1.125(b), the Substitute Specification (including 
the Abstract) contains no new matter. The amendments reflected in the Substitute Specification 
(including Abstract) are to conform the Specification and Abstract to United States Patent and 
Trademark Office rules or to correct informalities. As required by 37 C.F.R. §§ 1.121(b)(3)(ii) 
and 1.125(c), a Marked-Up Version of the Substitute Specification comparing the Specification of 
record and the Substitute Specification also accompanies this Preliminary Amendment. Approval 
and entry of the Substitute Specification (including Abstract) are respectfully requested. 

The underlying PCT Application No. PCT/DE03/02310 includes an Intemational 
Search Report, dated November 3, 2003. The Search Report includes a list of documents that 
were uncovered in the underlying PCT Application. A copy of the Search Report accompanies 
this Preliminary Amendment. 

It is asserted that the subject matter of the present application is new, non-obvious, 
and useful. Prompt consideration and allowance of the application are respectfully requested. 

Respectfully Submitted, 

KENYON & KENYON 




New York, NY 10004 j/y?! J 

212) 425-7200 
212) 425-5288 
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Field of the Invention 

The present invention relates to a device and a method for 
controlling and/or regulating operational sequences, 

10 particularly in a motor vehicle-^ In thio context , in which a 

functional unit for forwarding and receiving data via at least 
one connecting unit is in contact with at least one bus 
system-: — The functional unit io monitored by a monitoring unit, 
the OGnoing of data by the functional unit via the at Icaot 

15 one buo Qyotcm io prevented by the monitoring unit in caoQ an 
error of the functional unit io detected. 

The prooGnt — invention aloo rclatca to a device for controlling 
and/or regulating operational — ocqucncco , — particularly in a 
motor vehicle. The device includeo at Icaot one functional 

20 unit which, — for forwarding and receiving data via at Icaot one 
connecting unit, — io in contact with at leaot one buo oyotem. 
Beoidco that, — the device includeo at Icaot one monitoring unit 

which monitoro the functional unit. The monitoring unit 

prevent o the forwarding of data by the functional unit via the 

25 at Icaot one buo oyotem in caoc it dctecto an error of the 
functional unit. 

Finally, — the prcocnt — invention aloo rclatco to a control unit 
for controlling and/or regulating operational ocqucncco, 
particularly in a motor vehicle. The control unit includeo a 

30 functional unit which, — for forwarding and receiving data via 
at leaot one connecting unit, — io in contact with at leaot one 
buo oyotem, — and a monitoring unit which monitoro the 

functional unit. The monitoring unit prevento the forwarding 

of data by the functional unit via the at leaot one buo oyotem 

35 in caoc it dctecto an error of the functional unit. 
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Background Inf ormat ion 

A circuit configuration for decoupling an electronic device 
from a data line in a motor vehicle is known f ro m descr ibed , 
e.g., in published German patent document DE 198 33 462^AJt. 
5 The electronic device and at least one additional electrical 
system exchange data via the data line, during the operation 
of the electronic device. In the case of the circuit 
configuration where vehicle operation can be maintained 
despite a malfunction of an electronic device connected to the 

10 data line, the electronic device is connected to a fault 

detection device. In response to the fault detection device 
ascertaining a fault of the electronic device, the electronic 
device is decoupled from the data line by the circuit 
configuration, the serviceability of the electronic system 

15 being maintained. 

In published German patent document DE 198 33 462 Al the 
important thing aspect is particularly the monitoring of the 
data line and the detection of errors in the data line, which 
could impair the operability of the electronic device that is 

20 connected to the data line. The error detection device is 
switched into the data line for decoupling the electronic 
device from the data line in the error case, and it includes 
electrical switching elements so as to be able to cut off the 
data line in case of error. That assumes, however, that in 

25 each data line to which the electronic device is connected and 
which is supposed to be cut off in the error case, switching 
elements have to be situated. 

A method and a dcvicG of the typo mentioned at the outact arc 
known f ro m Published German patent document DE 100 30 996 A3r^ 

30 There it io propoocd that describes an arrangement in which the 
functional monitoring of the functional unit by the monitoring 
unit is able to be activated or deactivated by the functional 
unit, using a switching element. The switching element is 
able to be implemented by the setting or deleting of a bit. 

35 During an activated monitoring function, the functional unit 
is disconnected from the bus system by an access. For this. 
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the monitoring unit activates an additional switching element, 
by which the connection of the functional unit to the bus 
system is interrupted. Here too, it has proven problematical 
that likewise separate switching elements have to be provided 
5 in the connection between the functional unit and the bus 

system, so that the functional unit is able to be decoupled 
from the bus system in the error case . 

In addition, from the rclatcd prior art, monitoring concepts 
for functional units are known, oopcciall y e ,g . , for motor 

10 vehicle control units, in which the monitoring unit triggers a 
reset in the error case. As a result of the reset, the 
functional unit runs up and thereafter attains its operational 
state. If the error of the functional unit continues to 
exist, the monitoring unit detects the error only in the newly 

15 operational state, and only then does it trigger again a reset 
of the functional unit. The forwarding of data by the 
functional unit via the bus system is only prevented for a 
short period of time during the reset state, since only in 
this state are the input /output connection positions (so- 

20 called ports) of the functional unit inactive. Thus, in the 
known method, a faulty functional unit may possibly forward 
faulty data via the bus system, even though the monitoring 
unit has detected an error of the functional unit. This may 
lead to safety- relevant situations in the control of the 

25 operational sequences. 

Tho A n object of the present invention is baaed on the object 
e ^to provide preventing of the forwarding of data by the 
functional unit via the bus system safely, reliably and in a 
simple manner. 

30 Summary 

For the attainment — — thia — obj cat , — thc The present invention 
propooeo , — otart ing — from the method of — the t^'pe mentioned at 
the outoct , provides that an error signal is emitted by the 
monitoring unit that assumes different values as a function of 
35 whether an error of the functional unit has been detected or 
not, and that the error signal is applied at the at least one 

NYOl 916171 vl 3 MARKED-UP VERSION OF 

SUBSTITUTE SPECIFICATION 



connecting unit, and the at least one connecting unit is 
deactivated by the applied error signal if an error of the 
functional unit has been detected. 

Summar^^ of the Invention 

5 In the method according to the present invention, no reset is 
triggered by the monitoring unit in response to a detected 
error, but rather a connecting unit that is situated between 
the functional unit and the bus system is simply switched off. 
The connecting unit is developed, for example, as a signal 

10 amplification device, copciQlly e . g . , as a bus driver circuit 
of the bus system (so-called bus driver) . The bus driver is 
use d particularly , e.g., for amplifying a bus signal generated 
by bus control (so-called bus controller) , before it is 
transmitted via the bus system, as well as for signal 

15 conditioning that is free of retrospective effect. Thus, 

according to the present invention, the functional unit per se 
remains in an operable state and is still able to generate 
data. However, these data are no longer able to be 
transmitted via the bus system, since the connecting unit 

20 required for the forwarding of data has been deactivated. 

By the use of the method according to the present invention, 
the impairment of other functional units, which are in contact 
via the bus system with the faulty functional unit, is 
prevented in a simple manner. Consequently, in the error 
25 case, an erroneous functional unit is not able to forward any 
potentially faulty or undesired data via the bus system. This 
results in intrinsically safe individual systems in an 
integrated network. 

It is copccially advantageous that the forwarding of data by 
30 the functional unit may be prevented safely and reliably, 

without the use of additional switching elements between the 
functional unit and the bus system or in the bus system 
itself. In addition, using the present invention, the 
forwarding of data by the functional unit io permanent ly may be 
35 prevented indefinitely , which has the advantage compared to 
the reset of the functional unit that the faulty functional 
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unit is at no timG not able any more to forward data via the 
bus system. To the extent that the errors of the functional 
unit permit it, the latter still works quite normally, i.e._^ 
it still generates data for controlling and/or regulating the 
5 operational sequences, these data, however_^ possibly being 

erroneous. However, these data are not able to be transmitted 
via the bus system. By permitting further operation of the 
functional unit_^ it is possible to continue to monitor the 
functional unit, even in the error case, and directly to once 
10 again permit again the forwarding of data by the functional 
unit as soon as the error of the functional unit no longer 
occurs . 

The reason for the ncccaoary prevention of need to prevent the 
forwarding of data by the functional unit in the error case is 

15 that an erroneous functional unit poaoibly may no longer 

haa have control over itself and over the correct generation of 
data to be sent, and because of its own error it is also not 
able to switch itself off reliably and safely. Because of a 
defective functional unit in an integrated network, in which 

20 . several functional units are in contact with one another via a 
bus system, there is a danger that the remaining receiving 
functional units on the bus syste m may receive erroneous data 
from the erroneously forwarding functional unit, and thus 
prompted, carry out unwanted actions. These actions triggered 

25 by erroneous data may also have a safety-relevant effect on 
the operational sequences that are to be controlled. Taking 
the example of motor vehicle control units, a control unit for 
the internal combustion engine could, in the error case, for 
example, cause a transmission control unit to shift down into 

30 lower gears, whereby the vehicle could arrive at an unstable 
travel state . 

According to one advantagcouo refinement example embodiment of 
the present invent ion_^ it is propoocd p rovided that the error 
signal is applied to a reset input of the at least one 

35 connecting unit-: The react — input — is also dcoignatcd ao rcoct 

input . In case of an error, the connecting unit is able to be 
deactivated by the error signal present at the reset input. 
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According to one pre f crrcd exampl e embodiment of the present 
invention^ it is propoacd provided that the functional unit is 
in contact with several bus systems and that the error signal 
is applied to connecting units of several of the bus systems. 
5 The advantage of the present invention, that the forwarding of 
data by an erroneous functional unit is able to be prevented 
safely and reliably without the use of additional hardware, 
such as, for instance, additional switching elements for 
interrupting the connection between erroneous functional unit 

10 and bus system, is especially useful when the erroneous 
functional unit is in contact not only with one but with 
several bus systems, via which data are able to be sent to 
other functional units. In all bus systems that are connected 
to the erroneous functional unit and which are to be 

15 deactivated in case of an error, the error signal of the 
monitoring unit is conducted to the connecting units. Bus 
systems which are only used for transmitting data of non- 
safety-relevant operational sequences (e.g.^ of comfort 
functions) , do not necessarily have to be switched off in case 

20 of an error of the functional unit. 

Furthermore, according to an example embodiment of the present 
invention , it is propoocd provided that the error signal be 
applied at the outputs of components whose operational 
sequences are controlled or regulated by the erroneous 
25 functional unit. These components are, for example, outputs of 
the ignition, the fuel injection and/or the throttle valve of 
an internal combustion engine. The aim of this measure is to 
bring the internal combustion engine safely to a stop, in case 
of an error in the controlling or regulating functional unit. 

30 It io propoocd ao part icularl^y n nay be advantageous that, after 
the detection of an error of the functional unit, the 
functional unit continues to be monitored by the monitoring 
unit, and the at least one connecting unit is activated again 
in case a proper function of the functional unit is detected. 

35 This renewed activation of the connecting units is possible at 
any time in the present invention. In contrast, in the 
rclatcd prior art, in which, in case of an error, a reset of 
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the erroneous functional unit is executed, a proper 
functioning of the functional unit could only be detected 
oubooqucnt ly subsequent to the reset and the running up of the 
functional unit. Consequently, using the present invention, 
5 one may improve not only the safety of an integrated network 
which includes several functional units that are in contact 
with one another via a bus system, but also the availability 
of the integrated network, since the proper functioning of a 
functional unit may be detected particularly rapidly. 

10 Ao an additional attainment of the object of the prooont 

invention it io propoocd, — atarting from the dovicc of the type 
named at the outoct, — that thc The monitoring unit ohould 
havc has means for forming and emitting an error signal which-r 
assumes different values as a function of whether or not the 

15 monitoring unit has detected an error of the functional unit, 
and that the error signal ohould bc is conducted to the at 
least one connecting unit and that the at least one connecting 
unit should be able to be deactivated by the error signal that 
is present, if the error of the functional unit was detected. 

20 The device corresponds, for example, to an integrated network 
that includes several functional units which are in contact 
with one another via a bus system , 

According to one advantagoouo refinement embodiment of the 
present invent ion_^ it is propooc dp rovided that the error 
25 signal is applied to an enable/disable input of the at least 
one connecting unit. Alternatively_^ it is propoocd provided 
that the error signal be conducted to a reset input of the at 
least one connecting unit. 

The device advantageously includes several functional units 
30 which are connected to one another via a bus system, and at 

least one monitoring unit, the monitoring unit preventing the 
forwarding of data by a functional unit via the at least one 
bus system, in case the monitoring unit has detected an error 
of this functional unit. Such a device corresponds to the so- 
35 called mult i -control unit concept that has increasingly been 
used in motor vehicles recently, in which several control 
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units are put in in parallel to one another to increase 
computational performance, the individual control units each 
controlling a certain part of the operational sequences. 
Thus, for example, in a two- control unit concept for 
5 controlling an 8-cylinder internal combustion engine, a first 
control unit is put in for controlling four of the cylinders 
and a second control unit for controlling the remaining four 
cylinders. The two control units are in contact with each 
other via a bus system. Data concerning the operational state 

10 of the internal combustion engine or of the motor vehicle are 
only supplied to the first control unit, which then passes the 
data on to the second control unit via the bus system. If the 
monitoring unit of the first control unit detects an error of 
the control unit, it deactivates the connecting unit of the 

15 bus system to the second control unit, so as to prevent the 
first control unit from forwarding erroneous data to the 
second control unit and having the second control unit 
controlling the remaining four cylinders of the internal 
combustion engine in a faulty manner and even possibly having 

20 a safety-relevant situation coming about. 

Finally, as still another attainment of the obj oot example 
embodiment of the present invention_j_ it is propoood, — otarting 
from the control unit of the typo named at the outoct, 
provided that the monitoring unit ohould have has means for 

25 forming and emitting an error signal which assumes different 

values as a function of whether or not the monitoring unit has 
detected an error of the functional unit, and that the error 
signal ohould bc is conducted to the at least one connecting 
unit and that the at least one connecting unit ahould bc is 

30 able to be deactivated by the error signal that is present, if 
the error of the functional unit was detected. 

Brief Dcocription of the Drawings 

Further fcaturca, — uoca and advantages of the prcocnt invention 
come to light — from the following dcocription of exemplary 
35 embodiment o of — the prcocnt — invention which arc — ohown in the 
drawingo . In thio context, — all of the dcocribcd or 
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rcprcocntcd f caturco , — alono or in any combination, — form the 
oubjcct matter of — the prcocnt — invention, — rcgardlooa of their 
combination in the patent claimo or their antecedents, — ao well 
ao rogardleoo of their formulation and repreoentation in the 

5 opecif ication and drawingo . 5*ie — figurco ohow ; Brief 

Description of the Drawings 

Figure 1 shows an example embodiment of a control unit of the 
present inventio n according to one preferred opQcific 
embodiment ;^ 

10 Figure 2 shows an example embodiment of a device according to 
the present invention, including two control units according 
to the present invention, which are in contact with one 
another via a bus system-; — and _^ 

Figure 3a shows a time curve of the state of an error counter 
15 of monitoring module . 

Figure 3 Figures 3b- 3d show the curves of various states and 
signals of a conventional control unit known from the related 
a^efe — (Figurco 3b to 3d) — compared to the control unit according 
to the prcocnt invention — (Figurco 3c and 3f ) , 

20 Figures 3e-3f show the curves of various states and signals of 
the control unit according to the present invention. 

Dcocription of the Exemplary Embodiments Detailed Description 

In Figure 1, a control unit SG according to the present 
invention is designated in its entirety by reference numeral 

25 1. Control unit 1 is used, for example, for controlling 

and/or regulating operational sequences in a motor vehicle. 
Subsequently, we will go into more detail, for example, on a 
control unit 1 for controlling of operational sequences in an 
internal combustion engine of a motor vehicle. However, the 

30 present invention is generally applicable to all types of 

control units SG, such as for transmission control, vehicle 
dynamics control, drive slip control (ASR) , an automatic 
distance control (EDC; electronic distance control) , adaptive 
cruise control (ACC) , etc, which control units are in contact 

NYOl 916171 vl 9 MARKED-UP VERSION OF 

SUBSTITUTE SPECIFICATION 



with one another via a bus system 2 to an integrated control 
unit system, and which exchange data among one another via bus 
system 2. Bus system 2 is, for instance, developed as a CAN 
(controller area network) . 

5 Control unit 1 includes a functional calculator FR 3 which is 
designed, for instance, as a microprocessor or as a 
microcontroller. A computer program is able to be run on 
functional calculator 3 which is used to carry out the control 
and/or regulating function of control unit 1. Functional 

10 calculator 3 is in contact with bus system 2 via connecting 

unit 4, for forwarding and receiving data. Connecting unit 4 
is designed as a hardware interface between a controller and 
an external control unit monitoring bus having a signal 
amplification device, especially as a bus driver circuit, e.g. 

15 as a CAN driver for a CAN bus system^^ — C7VN driver , i.e., 
connecting unit 4 is also designated as CAN driver. 

The data generated in functional calculator 3 within the scope 
of executing the computer program to fulfill the control 
and/or regulating function of control unit 1 are first 

20 transmitted to a CAN control 6 via a data bus 5, which is also 
designated as CAN controller- In CAN control 6, the data 
generated by functional calculator 3 are put into a format 
corresponding to the CAN protocol, und are prepared for 
transmission via CAN bus system 2 . Before transmission of the 

25 processed data, the signals have to be adapted to the 

electrical properties on the CAN bus. For this purpose, the 
processed data are transmitted via a two-wire data line 7 from 
CAN control 6 to CAN driver 4, which puts the signals on CAN 
bus system 2 . 

30 Independent hardware for functional monitoring functional 
calculator 3 is assigned to functional calculator 3 . The 
independent hardware is designated as monitoring module UM 8 . 
Monitoring module 8 cyclically poses various questions to 
functional calculator 3, which run through voluminous control 

35 mechanisms, such as program sequence controls or command tests 
in functional calculator 3, and form a result. The result is 
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transmitted back to monitoring module 8 as a response to the 
question. A functional calculator working error- free supplies 
back the correct response within a predefined time window , 
Monitoring module 8 determines by evaluating the response 
5 whether an error of functional calculator 3 has occurred or 
not. The monitoring concept dcoGribcd of functional 
calculator 3 by monitoring module 8 is also designated as 
inquiry- response communication. The communication between 
monitoring module 8 and functional calculator 2 takes place 
10 via an SPI (serial parallel interface) interface 9. 

By evaluating the response of functional calculator 3, an 
error signal WDA is generated in monitoring module 8, which 
assumes different values as a function of whether an error of 
functional calculator 3 was detected or not. Preferably, an 
15 error counter is incremented if an error of functional 
calculator 3 is detected. 

Error signal WDA is emitted only when the error counter has 
exceeded a threshold value. Error signal WDA is applied, via a 
signal line 10, to outputs El to EN of motor vehicle 

20 components Kl to Kn, which are activated by control unit 1 for 
controlling and/or regulating the operating sequences. In a 
motor vehicle control unit 1 for controlling and/or regulating 
an internal combustion engine, these are, for example, the 
outputs for ignition, fuel injection and/or throttle valve. 

25 The activation of outputs El to En using error signal WDA is 
for the purpose, in case of error, to bring the internal 
combustion engine safely to a standstill and to avoid safety- 
relevant situations . 

According to the present invention, error signal WDA is also 
30 applied to a reset input RST of CAN driver 4. CAN driver 4 is 
deactivated by the error signal that is present in case an 
error of functional calculator 3 was detected. Thereby the 
forwarding of data by a defective functional calculator 3 via 
CAN bus system 2 is prevented reliably, effectively and, above 
35 all, durably for the entire duration of the error of the 
functional calculator. Thereby, also, the forwarding of 
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possibly erroneous information by erroneous functional 
calculator 3 via CAN bus system 2 to other functional 
calculators is prevented in a simple manner. Consequently, 
control unit 1 according to the present invention represents 
5 an intrinsically safe individual system in a composite control 
unit system. It satisfies the rules for control units in a 
composite control unit system, namely that each control unit 1 
itself bears the responsibility for the data forwarded by it. 

An additional advantage of the present invention is that an 

10 erroneous functional calculator 3 continues to operate 

normally and continues to ascertain data, albeit some possibly 
erroneous, for controlling the operating sequences. 
Monitoring module 8 is thus able to continue to monitor the 
operability of functional calculator 3 even after detecting an 

15 error of functional calculator 3. As long as monitoring 
module 8 detects an error of functional calculator 3, CAN 
driver 4 remains deactivated so that the erroneous date 
ascertained by erroneous functional calculator 3 do not get 
onto CAN bus system 2 and are able to impair other functional 

20 calculators of the composite control unit system. However, as 
soon as monitoring module 8 detects a proper functioning of 
functional calculator 2, CAN driver 4 may be activated again, 
so that control unit 1 is able to operate quite normally 
again. In the present invention^ it is advantageous that a 

25 proper functioning of functional calculator 3 is able to be 
detected without a long time delay. 

Another advantage of the present invention may be seen in that 
the forwarding of data by an erroneous functional calculator 3 
may be prevented in a simple manner and without additional 
30 hardware, for example, without additional circuit elements 
that are put into the CAN bus system and are opened in the 
error case in order to separate functional calculator 3 from 
CAN bus system 2 . 

In Figure 2 a multi-control unit concept, to oay it more 
35 accurately-r a two-control unit concept_^ is shown in which two 
control units SGI and SG2 for controlling certain operating 
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sequences are used. In the exemplary embodiment shown, the 
two control units SGI, SG2 for controlling the operating 
sequences in a 12 -cylinder internal combustion engine BM 11 
are used. In this context, first control unit SGI controls 
5 the first six cylinders ZYL 12 and the second control unit SG2 
controls the remaining six cylinders ZYL 13 . First control 
unit SGI receives data S via driver command (setting of the 
gas pedal) and/or via the operating state of internal 
combustion engine 11 and of the motor vehicle from 

10 corresponding sensors. Control units SGI and SG2 are 

connected to each other via a CAN bus system 2 . Second 
control unit SG2 receives setpoint inputs (e.g. the driver's 
command) from first control unit SGI, via CAN bus system 2. 
In order to avoid that, — ifi— case of an error of functional 

15 calculator FRl of first control unit SGI, in order to avoid 
erroneous setpoint inputs a^eebeing transmitted to second 
control unit SG2, according to the present invention, the 
forwarding of data by functional calculator FRl via CAN bus 
system 2 is prevented by monitoring unit module UMl . To do 

20 this, error signal WDA of monitoring module UMl is applied to 
a reset input RST of CAN driver 4 . 

With the aid of the data transmission that fails to 
materialize (message interruption, or rather mioaing no up- 
dating) , control unit SG2 is able to detect a defect in SGI, 
25 and to activate corresponding substitute measures or error 
reactions in SG2 . 

Figures 3a to 3f show curves of various control unit states 
and control unit variables plotted against time t. In 
particular, Figure 3a shows the state of an error counter of 

30 monitoring module 8. At the beginning, this rises from zero 
to above a threshold value SW. As soon as the error counter 
exceeds threshold value SW, an error reaction is triggered at 
time ti- That means that error signal WDA assumes a 
corresponding value. As values of error signal WDA, HIGH and 

35 LOW are especially applicable. 
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The curves shown in Figures 3b, 3c and 3d correspond to the 
rclatod prior art. Figure 3b shows the curve of a reset signal 
which, according to the rclatcd prior art, is applied by 
monitoring module UM 8 to a reset input of functional 
5 calculator FR 3. At time ti the error reaction is triggered 
which, according to the rclatcd p rior art, consists in 
triggering a reset of functional calculator FR 3 . Figure 3c 
shows the curve of a quantity '^CAN signal released" . The 
signal has the values "free" or ^^blocked" . From Figure 3c one 

10 may see that the CAN signal is only blocked during the reset 
(RST = 1 in Figure 3b) and is otherwise free. As long as CAN 
signal is released, even an erroneous functional calculator 
FR 3 may possibly transmit erroneous data via CAN bus system 
2. Under certain circumstances, this may trigger erroneous 

15 reactions in other functional calculators FR of the composite 
control unit system . 

Figure 3d shows various states of control unit SG that is 
known from the rclatcd p rior art . Before triggering the error 
reaction at time ti, control unit SG runs through a quite 

20 normal travel program A. Thereafter, a reset state B follows 
after time ti. Subsequently, control unit SG runs an 
initializing phase C, and then in turn changes into normal 
travel program A. During travel program A, monitoring module 
UM carries out an inquiry-response communication with 

25 functional calculator FR that is to be monitored, and detects 
at time t2 that the error of functional calculator FR is still 
there- Thereafter, the system runs afresh through the above- 
described states reset B, initializing C and travel program A 
with inquiry -response communication D. 

30 Figures 3e and 3f show the signal curves and state curves of 
control unit 1 according to the present invention. In Figure 
3e one may clearly recognize that the CAN signal is blocked 
for the duration of the error directly after the error 
reaction at time ti . After the error reaction, functional 

35 calculator 3 is in a quite normal travel program A, during 
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which an inquiry- response communication D is cyclically 
executed, and the outputs via the WDA signal are in a 
deactivated state (E) . However, the data ascertained by 
functional calculator 3 are not transmitted via CAN bus system 
5 2, since CAN driver 4 has been deactivated and consequently 
the CAN signal is blocked. In the present invention, in the 
error case, functional calculator 3 is never in a situation in 
which the operability of functional calculator 3 could not be 
checked by an inquiry- response communication. By contrast, in 

10 the rclatc d prior art, in the error case, checking the 

operability of functional calculator 3 could not take place 
during the states reset B and initializing C, It is for this 
reason that the proper functioning of functional calculator 3 
is detected earlier in the case of the present invention than 

15 with the related art . 
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The present invention rclatca to provides a method and a device 
for controlling operational sequences, in particular in a 
vehicle. In this context, a functional unit 4^-) — for forwarding 
and receiving data via at least one connecting unit 44-) — is in 
contact with at least one bus system — (-34-. Functional unit (3 ) 
is monitored by a monitoring unit — (-84-. The monitoring unit — (-84- 
prevents the forwarding of data by the functional unit 43-) — ^via 
the at least one bus system 4^-) — if ^ the monitoring unit 
detects an error of the functional unit — (^4-- In an error case, 
in order to prevent the forwarding of data by functional unit 

— i n a manner as simple as possible a manner , yet one that 
is safe and reliable, it io propoocd that an error signal 
(WDA) — beis emitted by the monitoring unit — (-8^, which error 
signal assumes different values as a function of whether an 
error of the functional unit — f34- has been recognized or not, 
and the error signal (WDA) — feeis applied to the at least one 
connecting unit 444 — an dsuch that the at least one connecting 
unit 444 — beis deactivated by the error signal (WDA) — that io 
prcocnt , — if an error of the functional unit 43^ — has been 
detected. 

(Figure 1) 
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